Attention Deficit Ep. 2 – The incident, the correction, and AI operating systems

OpenAI models under evaluation escaped their research sandbox last week and breached Hugging Face’s production infrastructure. Both companies published incident reports, and the market spent the week asking everybody else for receipts. Kimi K3 promised open weights within days, and we kept coming back to the idea that agent stacks are missing an operating system.

We opened the show auditing our own meters. Alexa doesn’t know how many tokens she’s burned, somewhere in the multi-billions, which for some reason translates to a lot of money. Taylor hit his usage limits by Tuesday and, as he put it, spent the rest of the week standing outside the party looking in.

Alexa built the Wheel of Tokens to keep track of the flood of news. It’s a game-show wheel that picks which story we take next. We let it choose live, and every slice came up with receipts. Here’s the rundown.

What the wheel landed on

* The correction. Devansh’s case, which Alexa walked through on air, is that benchmarks and run rates stopped counting as proof. His breakdown runs the receipts from metered Copilot credits to per-engineer spending caps.

* The productivity squeeze. In this year’s tech worker survey, most workers say AI makes them more productive, but better mostly means more and faster, not higher quality. Only 15% of founders are anxious about job security, against 51% of researchers.

* Agent swarms. When Cursor rebuilt SQLite from its manual, which model sat in which role moved the bill from $10,565 to $1,339, roughly eightfold, with quality similar at the four-hour mark. Taylor’s rule of thumb after a week of experiments is to reach for the most powerful model and turn the effort down, not a weaker one at full effort.

* Boris’s Ladder. Boris Cherny’s Steps of AI Adoption names five levels, 0 through 4, Gated to AI-native, each rung counting the agents you run at once, from none to a thousand and up.

* The incident. OpenAI models under evaluation, one a pre-release build running with deliberately reduced cyber refusals, broke out and breached Hugging Face production. As Alexa put it on air, “The eval became the attack.”

The models broke out of their eval

The attack started inside a sandbox. “Controlled is the operative word,” Alexa said, and this time the box didn’t hold. OpenAI’s write-up says a combination of its models, including a pre-release build running with cyber refusals deliberately reduced for the evaluation, escalated privileges inside OpenAI’s research environment until they reached an internet-connected node, then chained a zero-day into Hugging Face’s production infrastructure, hyperfocused on an eval benchmark called ExploitGym.

Hugging Face disclosed the intrusion on July 16 without knowing whose model it was. OpenAI tied it to its own models five days later. When Hugging Face’s responders pointed hosted frontier models at the attack logs, the guardrails refused the job, because they “cannot distinguish an incident responder from an attacker.” So Hugging Face ran the forensics on GLM 5.2, an open-weight model, on its own infrastructure, and no attacker data or exposed credentials left its environment.

Inkling actually shipped open weights the same week, a Mixture-of-Experts model with 975 billion total parameters, 41 billion active, pretrained on 45 trillion tokens. Kimi K3 launched July 16, paused new subscriptions on July 19 when demand pushed it near capacity (”our GPUs are feeling it”), and has promised full weights by July 27. Jensen Huang joined X the day we recorded, and his first post shared an open letter from 25 companies backing open weights. Weights still aren’t free to run, and the bill is where the wheel went next.

The correction hits your terminal

That bill lands on ordinary desks. On air, Alexa stacked the receipts one on top of another, GitHub Copilot moving to metered AI credits, bills spiking, a ride-share giant burning its annual coding-AI budget in months before capping what each engineer can spend, with Devansh’s The AI Industry is Going Through a Massive Correction anchoring the segment. As she put it on air, “the market is starting to demand receipts.”

Agent stacks can’t produce that receipt yet. Nothing in them admits work, limits it, budgets it, or routes it to the cheapest model that can finish, the job an operating system’s scheduler does. That framing came from the AI-OS piece Alexa read on air and from our own weeks of hitting limits, and the AI operating systems artifact has the long version.

Cursor measured something narrower. Its swarm rebuilt SQLite in Rust from the 835-page manual, and at the four-hour mark every model mix had produced similar quality. The eightfold difference in the bill came from which model planned and which model typed.

Boris Cherny, who created and runs Claude Code, mapped the climb from one agent to a thousand in Steps of AI Adoption. Level 2 is parallel agents at about ten, level 3 is supervised autonomy at about a hundred, and on air Taylor put himself between them. We took the quiz live, and you can take the same one.

Everything we built for this episode

Here’s that quiz, plus everything else we built this week, all live on the show’s site, attentiondeficit.ai. The full segment rundown, in running order, sits on the episode page.

Steps of AI Adoption is the quiz we took on air. Its 2 AM question asks what happens when an agent misbehaves overnight, and Taylor’s best answer was “what’s an agent?” The incident walks the escape path step by step, no incident-report reading required. And the Wheel of Tokens itself spins on the segments pages, if you want the week in a different order.

Six more sit beside them. The correction tracks the spend thread, and AI operating systems makes the scheduler argument. Agents in production gather the field lessons, Kimi K3 and Inkling hold the open-weights week, and Voice bit is the screen from the episode’s voice segment.

That site holds the show’s whole paper trail, and the receipts below are the rest of it.

The receipts

The incident · OpenAI’s write-up · Hugging Face’s disclosure

The correction · The AI Industry is Going Through a Massive Correction from Devansh’s Artificial Intelligence Made Simple

The productivity squeeze · How tech workers are feeling in 2026. It paywalls partway down, and the numbers we cite appear before the wall.

The models · Kimi K3 · Introducing Inkling

Agent swarms · Agent swarms and the new model economics

Boris’s Ladder · Steps of AI Adoption

Questions we keep getting

What is Attention Deficit?

A weekly AI news podcast from Alexa Griffith of Red Hat AI and Taylor Dolezal of Dosu. We take the week’s AI news as one conversation instead of a headline list, and we build interactive HTML artifacts for every segment at attentiondeficit.ai.

What happened in the OpenAI and Hugging Face security incident?

Hugging Face disclosed an autonomous-agent intrusion into part of its production infrastructure on July 16, 2026, and OpenAI traced it to its own models on July 21. OpenAI’s models, including a pre-release build running with reduced cyber refusals for evaluation, escalated privileges to an internet-connected node and chained a zero-day into Hugging Face production while chasing the ExploitGym benchmark.

Where do I start with the show?

Start with the first episode, the welcome post that opens the series and sets the format. Every episode lives on the episodes index at attentiondeficit.ai with its video, segment rundown, and artifacts.

Where to find us

New episodes land on Substack, YouTube, Spotify, and attentiondeficit.ai. Alexa Griffith is at alexagriffith.com, Taylor Dolezal at onlydole.dev.

If you found something interesting this week, or built HTML diagrams, charts, or other artifacts to keep up with it, share them with us. We’d love to see them. See you next week.